DEVEL15-windows-scache-hash-tables-20080612

LICENSE MIT

Prevent corruption of the cm_data.scacheHashTablep lists when removing
and then re-adding entries to the hash table.  The cm_scache_t nextp
fields were not being reset to NULL which permitted loops to be created.

(cherry picked from commit ef48d6343d9ac929a4a2ae88184f7801ace1e3d1)

diff --git a/src/WINNT/afsd/cm_freelance.c b/src/WINNT/afsd/cm_freelance.c
index a83a6e239b76f2f4c8610764faee213d179307c8..436e16d6a23765d6522d7f9ab39bffc5e9044538 100644 (file)
--- a/src/WINNT/afsd/cm_freelance.c
+++ b/src/WINNT/afsd/cm_freelance.c
@@ -419,6 +419,7 @@ int cm_reInitLocalMountPoints() {
                      lscpp = &tscp->nextp, tscp = tscp->nextp) {
                     if (tscp == scp) {
                         *lscpp = scp->nextp;
+                        scp->nextp = NULL;
                        lock_ObtainWrite(&scp->rw);
                         scp->flags &= ~CM_SCACHEFLAG_INHASH;
                        lock_ReleaseWrite(&scp->rw);

diff --git a/src/WINNT/afsd/cm_scache.c b/src/WINNT/afsd/cm_scache.c
index dcf89acd6876e2fbb6562ffa1b067cd4491f6a35..e6d6d9672bf066f08ba7c97ace3eddfa63ab592d 100644 (file)
--- a/src/WINNT/afsd/cm_scache.c
+++ b/src/WINNT/afsd/cm_scache.c
@@ -70,6 +70,7 @@ void cm_RemoveSCacheFromHashTable(cm_scache_t *scp)
             lscpp = &tscp->nextp, tscp = tscp->nextp) {
            if (tscp == scp) {
                *lscpp = scp->nextp;
+                scp->nextp = NULL;
                scp->flags &= ~CM_SCACHEFLAG_INHASH;
                break;
            }
@@ -751,8 +752,8 @@ long cm_GetSCache(cm_fid_t *fidp, cm_scache_t **outScpp, cm_user_t *userp,
         scp->dotdotFid.vnode=1;
         scp->flags |= (CM_SCACHEFLAG_PURERO | CM_SCACHEFLAG_RO);
         if (!(scp->flags & CM_SCACHEFLAG_INHASH)) {
-            scp->nextp=cm_data.scacheHashTablep[hash];
-            cm_data.scacheHashTablep[hash]=scp;
+            scp->nextp = cm_data.scacheHashTablep[hash];
+            cm_data.scacheHashTablep[hash] = scp;
             scp->flags |= CM_SCACHEFLAG_INHASH;
         }
         scp->refCount = 1;